Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.

The remote host is affected by the vulnerability described in GLSA-201512-10 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Mozilla Thunderbird. Please review the CVE identifiers referenced below       for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Versions of Mozilla Thunderbird prior to 38.1 are outdated and thus unpatched for the following vulnerabilities : 

 - A security downgrade vulnerability exists due to a flaw in Network Security Services (NSS). When a client allows for a ECDHE_ECDSA exchange, but the server does not send a ServerKeyExchange message, then the NSS client will take the EC key from the ECDSA certificate. A remote attacker can exploit this to silently downgrade the exchange to a non-forward secret mixed-ECDH exchange. (CVE-2015-2721)
 - Multiple memory corruption issues exist that allow an attacker to cause a denial of service condition or potentially execute arbitrary code. (CVE-2015-2724, CVE-2015-2725)
 - A use-after-free error exists in the 'CSPService::ShouldLoad()' function when modifying the Document Object Model to remove a DOM object. An attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-2731)
 - An uninitialized memory use issue exists in the 'CairoTextureClientD3D9::BorrowDrawTarget()' function, the '::d3d11::SetBufferData()' function, and the 'YCbCrImageDataDeserializer::ToDataSourceSurface()' function. The impact is unspecified. (CVE-2015-2734, CVE-2015-2737, CVE-2015-2738)
 - A memory corruption issue exists in the 'nsZipArchive::GetDataOffset()' function due to improper string length checks. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2735)
 - A memory corruption issue exists in the 'nsZipArchive::BuildFileList()' function due to improper validation of user-supplied input. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2736)
 - An unspecified memory corruption issue exists in the 'ArrayBufferBuilder::append()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2739)
 - A buffer overflow condition exists in the 'nsXMLHttpRequest::AppendToResponseText()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2740)
 - A security bypass vulnerability exists due to a flaw in certificate pinning checks. Key pinning is not enforced upon encountering an X.509 certificate problem that generates a user dialog. A man-in-the-middle attacker can exploit this to bypass intended access restrictions. (CVE-2015-2741)
 - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)

The version of Firefox is prior to 39.0 and is affected by multiple vulnerabilities : 

 - A security downgrade vulnerability exists due to a flaw in Network Security Services (NSS). When a client allows for a ECDHE_ECDSA exchange, but the server does not send a ServerKeyExchange message, the the NSS client will take the EC key from the ECDSA certificate. A remote attacker can exploit this to silently downgrade the exchange to a non-forward secret mixed-ECDH exchange. (CVE-2015-2721) 
 - Multiple user-after-free errors exist when using an XMLHttpRequest object in concert with either shared or dedicated workers. A remote attacker can exploit this to cause a denial of service condition. (CVE-2015-2722, CVE-2015-2733) 
 - Multiple memory corruption issues exist that allow an attacker to cause a denial of service condition or potentially execute arbitrary code. (CVE-2015-2724, CVE-2015-2725) 
 - A security bypass vulnerability exists due to a failure to preserve context restrictions. A remote attacker can exploit this, via a crafted web site that is accessed with unspecified mouse and keyboard actions, to read arbitrary files or execute arbitrary JavaScript code. (CVE-2015-2727) 
 - A type confusion flaw exists in the Indexed Database Manager's handling of IDBDatabase. A remote attacker can exploit this to cause a denial of service condition or to execute arbitrary code. (CVE-2015-2728) 
 - An out-of-bounds read flaw exists in the 'AudioParamTimeline::AudioNodeInputValue()' function when computing oscillator rending ranges. An attacker can exploit this to disclose the contents of four bytes of memory or cause a denial of service condition. (CVE-2015-2729) 
 - A signature spoofing vulnerability exists due to a flaw in Network Security Services (NSS) in its Elliptic Curve Digital Signature Algorithm (ECDSA) signature validation. A remote attacker can exploit this to forge signatures. (CVE-2015-2730) 
 - A use-after-free error exists in the 'CSPService::ShouldLoad()' function when modifying the Document Object Model to remove a DOM object. An attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code. (CVE-2015-2731) 
 - An uninitialized memory use issue exists in the 'CairoTextureClientD3D9::BorrowDrawTarget()' function, the '::d3d11::SetBufferData()' function, and the 'YCbCrImageDataDeserializer::ToDataSourceSurface()' function. The impact is unspecified. (CVE-2015-2734, CVE-2015-2737, CVE-2015-2738) 
 - A memory corruption issue exists in the 'nsZipArchive::GetDataOffset()' function due to improper string length checks. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2735) 
 - A memory corruption issue exists in the 'nsZipArchive::BuildFileList()' function due to improper validation of user-supplied input. An attacker can exploit this, via a crafted ZIP archive, to potentially execute arbitrary code. (CVE-2015-2736) 
 - An unspecified memory corruption issue exists in the 'ArrayBufferBuilder::append()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2739) 
 - A buffer overflow condition exists in the 'nsXMLHttpRequest::AppendToResponseText()' function due to improper validation of user-supplied input. An attacker can exploit this to potentially execute arbitrary code. (CVE-2015-2740) 
 - A security bypass vulnerability exists due to a flaw in certificate pinning checks. Key pinning is not enforced upon encountering an X.509 certificate problem that generates a user dialog. A man-in-the-middle attacker can exploit this to bypass intended access restrictions. (CVE-2015-2741) 
 - A privilege escalation vulnerability exists in the PDF viewer (PDF.js) due to internal workers being executed insecurely. An attacker can exploit this, by leveraging a Same Origin Policy bypass, to execute arbitrary code. (CVE-2015-2743) 
 - A man-in-the-middle vulnerability, known as Logjam, exists due to a flaw in the SSL/TLS protocol. A remote attacker can exploit this flaw to downgrade connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. (CVE-2015-4000)

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2731, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Thunderbird skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

After installing the update, Thunderbird must be restarted for the changes to take effect.

An updated thunderbird package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2731, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Thunderbird skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Herre, Ronald Crane, and David Keeler as the original reporters of these issues.

For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 31.8. You can find a link to the Mozilla advisories in the References section of this erratum.

All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 31.8, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.

The remote Oracle Linux 5 / 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-1455 advisory.

    [31.8.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [31.8.0-1]
    - Update to 31.8.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MozillaThunderbird was updated to fix 20 security issues.

These security issues were fixed :

  - CVE-2015-2727: Mozilla Firefox 38.0 and Firefox ESR 38.0     allowed user-assisted remote attackers to read arbitrary     files or execute arbitrary JavaScript code with chrome     privileges via a crafted website that is accessed with     unspecified mouse and keyboard actions. NOTE: this     vulnerability exists because of a CVE-2015-0821     regression (bsc#935979).

  - CVE-2015-2725: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 39.0,     Firefox ESR 38.x before 38.1, and Thunderbird before     38.1 allowed remote attackers to cause a denial of     service (memory corruption and application crash) or     possibly execute arbitrary code via unknown vectors     (bsc#935979).

  - CVE-2015-2736: The nsZipArchive::BuildFileList function     in Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     accesses unintended memory locations, which allowed     remote attackers to have an unspecified impact via a     crafted ZIP archive (bsc#935979).

  - CVE-2015-2724: Multiple unspecified vulnerabilities in     the browser engine in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1, and     Thunderbird before 38.1 allowed remote attackers to     cause a denial of service (memory corruption and     application crash) or possibly execute arbitrary code     via unknown vectors (bsc#935979).

  - CVE-2015-2730: Mozilla Network Security Services (NSS)     before 3.19.1, as used in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1, and     other products, did not properly perform Elliptical     Curve Cryptography (ECC) multiplications, which made it     easier for remote attackers to spoof ECDSA signatures     via unspecified vectors (bsc#935979).

  - CVE-2015-2743: PDF.js in Mozilla Firefox before 39.0 and     Firefox ESR 31.x before 31.8 and 38.x before 38.1     enables excessive privileges for internal Workers, which     might allowed remote attackers to execute arbitrary code     by leveraging a Same Origin Policy bypass (bsc#935979).

  - CVE-2015-2740: Buffer overflow in the     nsXMLHttpRequest::AppendToResponseText function in     Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     might allowed remote attackers to cause a denial of     service or have unspecified other impact via unknown     vectors (bsc#935979).

  - CVE-2015-2741: Mozilla Firefox before 39.0, Firefox ESR     38.x before 38.1, and Thunderbird before 38.1 do not     enforce key pinning upon encountering an X.509     certificate problem that generates a user dialog, which     allowed user-assisted man-in-the-middle attackers to     bypass intended access restrictions by triggering a (1)     expired certificate or (2) mismatched hostname for a     domain with pinning enabled (bsc#935979).

  - CVE-2015-2728: The IndexedDatabaseManager class in the     IndexedDB implementation in Mozilla Firefox before 39.0     and Firefox ESR 31.x before 31.8 and 38.x before 38.1     misinterprets an unspecified IDBDatabase field as a     pointer, which allowed remote attackers to execute     arbitrary code or cause a denial of service (memory     corruption and application crash) via unspecified     vectors, related to a 'type confusion' issue     (bsc#935979).

  - CVE-2015-2729: The     AudioParamTimeline::AudioNodeInputValue function in the     Web Audio implementation in Mozilla Firefox before 39.0     and Firefox ESR 38.x before 38.1 did not properly     calculate an oscillator rendering range, which allowed     remote attackers to obtain sensitive information from     process memory or cause a denial of service     (out-of-bounds read) via unspecified vectors     (bsc#935979).

  - CVE-2015-2739: The ArrayBufferBuilder::append function     in Mozilla Firefox before 39.0, Firefox ESR 31.x before     31.8 and 38.x before 38.1, and Thunderbird before 38.1     accesses unintended memory locations, which has     unspecified impact and attack vectors (bsc#935979).

  - CVE-2015-2738: The     YCbCrImageDataDeserializer::ToDataSourceSurface function     in the YCbCr implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2737: The rx::d3d11::SetBufferData function in     the Direct3D 11 implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2721: Mozilla Network Security Services (NSS)     before 3.19, as used in Mozilla Firefox before 39.0,     Firefox ESR 31.x before 31.8 and 38.x before 38.1,     Thunderbird before 38.1, and other products, did not     properly determine state transitions for the TLS state     machine, which allowed man-in-the-middle attackers to     defeat cryptographic protection mechanisms by blocking     messages, as demonstrated by removing a forward-secrecy     property by blocking a ServerKeyExchange message, aka a     'SMACK SKIP-TLS' issue (bsc#935979).

  - CVE-2015-2735: nsZipArchive.cpp in Mozilla Firefox     before 39.0, Firefox ESR 31.x before 31.8 and 38.x     before 38.1, and Thunderbird before 38.1 accesses     unintended memory locations, which allowed remote     attackers to have an unspecified impact via a crafted     ZIP archive (bsc#935979).

  - CVE-2015-2734: The     CairoTextureClientD3D9::BorrowDrawTarget function in the     Direct3D 9 implementation in Mozilla Firefox before     39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1,     and Thunderbird before 38.1 reads data from     uninitialized memory locations, which has unspecified     impact and attack vectors (bsc#935979).

  - CVE-2015-2733: Use-after-free vulnerability in the     CanonicalizeXPCOMParticipant function in Mozilla Firefox     before 39.0 and Firefox ESR 31.x before 31.8 and 38.x     before 38.1 allowed remote attackers to execute     arbitrary code via vectors involving attachment of an     XMLHttpRequest object to a dedicated worker     (bsc#935979).

  - CVE-2015-2722: Use-after-free vulnerability in the     CanonicalizeXPCOMParticipant function in Mozilla Firefox     before 39.0 and Firefox ESR 31.x before 31.8 and 38.x     before 38.1 allowed remote attackers to execute     arbitrary code via vectors involving attachment of an     XMLHttpRequest object to a shared worker (bsc#935979).

  - CVE-2015-2731: Use-after-free vulnerability in the     CSPService::ShouldLoad function in the microtask     implementation in Mozilla Firefox before 39.0, Firefox     ESR 38.x before 38.1, and Thunderbird before 38.1     allowed remote attackers to execute arbitrary code by     leveraging client-side JavaScript that triggers removal     of a DOM object on the basis of a Content Policy     (bsc#935979).

  - CVE-2015-4000: The TLS protocol 1.2 and earlier, when a     DHE_EXPORT ciphersuite is enabled on a server but not on     a client, did not properly convey a DHE_EXPORT choice,     which allowed man-in-the-middle attackers to conduct     cipher-downgrade attacks by rewriting a ClientHello with     DHE replaced by DHE_EXPORT and then rewriting a     ServerHello with DHE_EXPORT replaced by DHE, aka the     'Logjam' issue (bsc#931600).

USN-2656-1 fixed vulnerabilities in Firefox for Ubuntu 14.04 LTS and later releases.

This update provides the corresponding update for Ubuntu 12.04 LTS.

Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property. (CVE-2015-2721)

Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2722, CVE-2015-2733)

Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory safety issues in Firefox.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726)

Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions.
(CVE-2015-2727)

Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2728)

Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-2729)

Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730)

A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2731)

Ronald Crane discovered multiple security vulnerabilities.
If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

David Keeler discovered that key pinning checks can be skipped when an overridable certificate error occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited on its own.
(CVE-2015-2741)

Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another security vulnerability, to execute arbitrary code in a privileged scope. (CVE-2015-2743)

Matthew Green discovered a DHE key processing issue in NSS where a MITM could force a server to downgrade TLS connections to 512-bit export-grade cryptography. An attacker could potentially exploit this to impersonate the server. (CVE-2015-4000).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Mozilla Project reports :

MFSA 2015-59 Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)

MFSA 2015-60 Local files or privileged URLs in pages can be opened into new tabs

MFSA 2015-61 Type confusion in Indexed Database Manager

MFSA 2015-62 Out-of-bound read while computing an oscillator rendering range in Web Audio

MFSA 2015-63 Use-after-free in Content Policy due to microtask execution error

MFSA 2015-64 ECDSA signature validation fails to handle some signatures correctly

MFSA 2015-65 Use-after-free in workers while using XMLHttpRequest

MFSA 2015-66 Vulnerabilities found through code inspection

MFSA 2015-67 Key pinning is ignored when overridable errors are encountered

MFSA 2015-68 OS X crash reports may contain entered key press information

MFSA 2015-69 Privilege escalation through internal workers

MFSA 2015-70 NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-71 NSS incorrectly permits skipping of ServerKeyExchange

MozillaFirefox was updated to version 39.0 to fix 21 security issues.

These security issues were fixed :

  - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous     memory safety hazards (bsc#935979).

  - CVE-2015-2727: Local files or privileged URLs in pages     can be opened into new tabs (bsc#935979).

  - CVE-2015-2728: Type confusion in Indexed Database     Manager (bsc#935979).

  - CVE-2015-2729: Out-of-bound read while computing an     oscillator rendering range in Web Audio (bsc#935979).

  - CVE-2015-2731: Use-after-free in Content Policy due to     microtask execution error (bsc#935979).

  - CVE-2015-2730: ECDSA signature validation fails to     handle some signatures correctly (bsc#935979).

  - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers     while using XMLHttpRequest (bsc#935979).

  -     CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/     CVE-2015-2738/CVE-2015-2739/CVE-2015-2740:
    Vulnerabilities found through code inspection     (bsc#935979).

  - CVE-2015-2741: Key pinning is ignored when overridable     errors are encountered (bsc#935979).

  - CVE-2015-2743: Privilege escalation in PDF.js     (bsc#935979).

  - CVE-2015-4000: NSS accepts export-length DHE keys with     regular DHE cipher suites (bsc#935979).

  - CVE-2015-2721: NSS incorrectly permits skipping of     ServerKeyExchange (bsc#935979).

New features :

  - Share Hello URLs with social networks

  - Support for 'switch' role in ARIA 1.1 (web     accessibility)

  - SafeBrowsing malware detection lookups enabled for     downloads (Mac OS X and Linux)

  - Support for new Unicode 8.0 skin tone emoji

  - Removed support for insecure SSLv3 for network     communications

  - Disable use of RC4 except for temporarily whitelisted     hosts

  - NPAPI Plug-in performance improved via asynchronous     initialization

mozilla-nss was updated to version 3.19.2 to fix some of the security issues listed above.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2656-1 advisory.

    Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine.
    If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to     skip the ServerKeyExchange message and remove the forward-secrecy property. (CVE-2015-2721)

    Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit these to     cause a denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Firefox. (CVE-2015-2722, CVE-2015-2733)

    Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes     Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory     safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker     could potentially exploit these to cause a denial of service via application crash, or execute arbitrary     code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726)

    Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a     Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in     to opening a specially crafted website, an attacker could potentially exploit this to bypass security     restrictions. (CVE-2015-2727)

    Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to     opening a specially crafted website, an attacker could potentially exploit this to cause a denial of     service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox.
    (CVE-2015-2728)

    Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to obtain sensitive information.
    (CVE-2015-2729)

    Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A     remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730)

    A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user     were tricked in to opening a specially crafted website, an attacker could potentially exploit this to     cause a denial of service via application crash or execute arbitrary code with the priviliges of the user     invoking Firefox. (CVE-2015-2731)

    Ronald Crane discovered multiple security vulnerabilities. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit these to cause a denial of service via     application crash, or execute arbitrary code with the privileges of the user invoking Firefox.
    (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

    David Keeler discovered that key pinning checks can be skipped when an overridable certificate error     occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited     on its own. (CVE-2015-2741)

    Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a     user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in     combination with another security vulnerability, to execute arbitrary code in a privileged scope.
    (CVE-2015-2743)

    Matthew Green discovered a DHE key processing issue in NSS where a MITM could force a server to downgrade     TLS connections to 512-bit export-grade cryptography. An attacker could potentially exploit this to     impersonate the server. (CVE-2015-4000)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox installed on the remote Windows host is prior to 39.0. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox ESR installed on the remote Windows host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Thunderbird installed on the remote Mac OS X host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox installed on the remote Mac OS X host is prior to 39.0. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - An information disclosure vulnerability exists due to     crash reports containing key press information.
    (CVE-2015-2742)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

The version of Firefox ESR installed on the remote Mac OS X host is\ prior to 38.1. It is, therefore, affected by multiple vulnerabilities :

  - A security downgrade vulnerability exists due to a flaw     in Network Security Services (NSS). When a client allows     for a ECDHE_ECDSA exchange, but the server does not send     a ServerKeyExchange message, the NSS client will take     the EC key from the ECDSA certificate. A remote attacker     can exploit this to silently downgrade the exchange to a     non-forward secret mixed-ECDH exchange. (CVE-2015-2721)

  - Multiple user-after-free errors exist when using an     XMLHttpRequest object in concert with either shared or     dedicated workers. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-2722,     CVE-2015-2733)

  - Multiple memory corruption issues exist that allow an     attacker to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2015-2724,     CVE-2015-2725)

  - A security bypass vulnerability exists due to a failure     to preserve context restrictions. A remote attacker can     exploit this, via a crafted web site that is accessed     with unspecified mouse and keyboard actions, to read     arbitrary files or execute arbitrary JavaScript code.
    (CVE-2015-2727)

  - A type confusion flaw exists in the Indexed Database     Manager's handling of IDBDatabase. A remote attacker can     exploit this to cause a denial of service condition or     to execute arbitrary code. (CVE-2015-2728)

  - An out-of-bounds read flaw exists in the     AudioParamTimeline::AudioNodeInputValue() function when     computing oscillator rending ranges. An attacker can     exploit this to disclose the contents of four bytes of     memory or cause a denial of service condition.
    (CVE-2015-2729)

  - A signature spoofing vulnerability exists due to a flaw     in Network Security Services (NSS) in its Elliptic Curve     Digital Signature Algorithm (ECDSA) signature     validation. A remote attacker can exploit this to forge     signatures. (CVE-2015-2730)

  - A use-after-free error exists in the     CSPService::ShouldLoad() function when modifying the     Document Object Model to remove a DOM object. An     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code. (CVE-2015-2731)

  - An uninitialized memory use issue exists in the     CairoTextureClientD3D9::BorrowDrawTarget() function, the     ::d3d11::SetBufferData() function, and the     YCbCrImageDataDeserializer::ToDataSourceSurface()     function. The impact is unspecified. (CVE-2015-2734,     CVE-2015-2737, CVE-2015-2738)

  - A memory corruption issue exists in the     nsZipArchive::GetDataOffset() function due to improper     string length checks. An attacker can exploit this, via     a crafted ZIP archive, to potentially execute arbitrary     code. (CVE-2015-2735)

  - A memory corruption issue exists in the     nsZipArchive::BuildFileList() function due to improper     validation of user-supplied input. An attacker can     exploit this, via a crafted ZIP archive, to potentially     execute arbitrary code. (CVE-2015-2736)

  - An unspecified memory corruption issue exists in the     ArrayBufferBuilder::append() function due to improper     validation of user-supplied input. An attacker can     exploit this to potentially execute arbitrary code.
    (CVE-2015-2739)

  - A buffer overflow condition exists in the     nsXMLHttpRequest::AppendToResponseText() function due to     improper validation of user-supplied input. An attacker     can exploit this to potentially execute arbitrary code.
    (CVE-2015-2740)

  - A security bypass vulnerability exists due to a flaw in     certificate pinning checks. Key pinning is not enforced     upon encountering an X.509 certificate problem that     generates a user dialog. A man-in-the-middle attacker     can exploit this to bypass intended access restrictions.
    (CVE-2015-2741)

  - A privilege escalation vulnerability exists in the PDF     viewer (PDF.js) due to internal workers being executed     insecurely. An attacker can exploit this, by leveraging     a Same Origin Policy bypass, to execute arbitrary code.
    (CVE-2015-2743)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2722, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Firefox skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox.
(CVE-2015-2743)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Jann Horn, Paul Bandha, Holger Fuhrmannek, Herre, Looben Yan, Ronald Crane, and Jonas Jenwald as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.1 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2722, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Firefox skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox.
(CVE-2015-2743)

After installing the update, Firefox must be restarted for the changes to take effect.

From Red Hat Security Advisory 2015:1207 :

Updated firefox packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.

Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2722, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740)

It was found that Firefox skipped key-pinning checks when handling an error that could be overridden by the user (for example an expired certificate error). This flaw allowed a user to override a pinned certificate, which is an action the user should not be able to perform. (CVE-2015-2741)

A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox.
(CVE-2015-2743)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Jann Horn, Paul Bandha, Holger Fuhrmannek, Herre, Looben Yan, Ronald Crane, and Jonas Jenwald as the original reporters of these issues.

All Firefox users should upgrade to these updated packages, which contain Firefox version 38.1 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. This update also addresses a vulnerability in DHE key processing commonly known as the 'LogJam' vulnerability.

ID	Name	Product	Family	Severity
87710	GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)	Nessus	Gentoo Local Security Checks	critical
8879	Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)	Nessus Network Monitor	SMTP Clients	critical
8855	Mozilla Firefox < 39.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
84895	Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20150720)	Nessus	Scientific Linux Local Security Checks	critical
84893	RHEL 5 / 6 / 7 : thunderbird (RHSA-2015:1455)	Nessus	Red Hat Local Security Checks	critical
84890	Oracle Linux 5 / 6 / 7 : thunderbird (ELSA-2015-1455)	Nessus	Oracle Linux Local Security Checks	high
84884	CentOS 5 / 6 / 7 : thunderbird (CESA-2015:1455)	Nessus	CentOS Local Security Checks	critical
84864	openSUSE Security Update : MozillaThunderbird (openSUSE-2015-495) (Logjam)	Nessus	SuSE Local Security Checks	low
84794	Ubuntu 12.04 LTS : firefox vulnerabilities (USN-2656-2) (Logjam)	Nessus	Ubuntu Local Security Checks	low
84780	FreeBSD : mozilla -- multiple vulnerabilities (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)	Nessus	FreeBSD Local Security Checks	low
84720	openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-480) (Logjam)	Nessus	SuSE Local Security Checks	low
84664	Ubuntu 14.04 LTS : Firefox vulnerabilities (USN-2656-1)	Nessus	Ubuntu Local Security Checks	low
84582	Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)	Nessus	Windows	critical
84581	Firefox < 39.0 Multiple Vulnerabilities (Logjam)	Nessus	Windows	critical
84580	Firefox ESR < 38.1 Multiple Vulnerabilities (Logjam)	Nessus	Windows	critical
84578	Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	critical
84577	Firefox < 39.0 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	critical
84576	Firefox ESR < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)	Nessus	MacOS X Local Security Checks	critical
84550	CentOS 5 / 6 / 7 : firefox (CESA-2015:1207)	Nessus	CentOS Local Security Checks	critical
84543	Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150703)	Nessus	Scientific Linux Local Security Checks	critical
84535	RHEL 5 / 6 / 7 : firefox (RHSA-2015:1207)	Nessus	Red Hat Local Security Checks	critical
84534	Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1207)	Nessus	Oracle Linux Local Security Checks	critical
84510	Debian DSA-3300-1 : iceweasel - security update (Logjam)	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2015-2731

high

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

low

low

low

low

low

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

low